Manual Install

kubectl create namespace nshieldkeysafe5

istioctl install -y

openssl genrsa -out ~/keysafe5-install/rabbit.key 4096
export DNS1="*.rabbit-chart-rabbitmq-headless.rabbitns.svc.cluster.local"
export DNS2=rabbit-chart-rabbitmq.rabbitns.svc
export DNS3=rabbitmq.rabbitns.svc.cluster.local

export HOSTIP=127.0.0.1
openssl req -new -key ~/keysafe5-install/rabbit.key \
  -out ~/keysafe5-install/rabbitmq.csr \
  -subj "/CN=rabbitmq" \
  -addext "keyUsage=digitalSignature" \
  -addext "extendedKeyUsage=serverAuth" \
  -addext "subjectAltName=DNS:rabbitmq,DNS:${DNS1},DNS:${DNS2},DNS:${DNS3},IP:${HOSTIP}"
openssl ca -config ~/keysafe5-install/internalCA/internalCA.conf \
  -out rabbit.crt \
  -in rabbitmq.csr -batch
rm rabbitmq.csr

kubectl create namespace rabbitns
kubectl create secret generic rabbitmq-certificates \
  --namespace=rabbitns \
  --from-file=ca.crt \
  --from-file=tls.crt=rabbit.crt \
  --from-file=tls.key=rabbit.key
kubectl -n rabbitns create secret generic rabbitmq-pw \
  --from-literal=rabbitmq-password=guest

helm repo add bitnami https://charts.bitnami.com/bitnami && helm repo update
helm install rabbit-chart \
  --namespace=rabbitns \
  --set image.tag=3.12.13-debian-12-r1 \
  --set auth.username=guest \
  --set auth.existingPasswordSecret=rabbitmq-pw \
  --set auth.tls.enabled=true \
  --set auth.tls.existingSecret=rabbitmq-certificates \
  --set replicaCount=2 \
  --set service.type=LoadBalancer \
  --set extraConfiguration='
    listeners.ssl.default = 5671
    ssl_options.versions.1 = tlsv1.3
    ssl_options.depth=0
    ssl_options.verify = verify_peer
    ssl_options.fail_if_no_peer_cert = true
    auth_mechanisms.1 = EXTERNAL
    ssl_cert_login_from = subject_alternative_name
    ssl_cert_login_san_type = dns
    ssl_cert_login_san_index = 0' \
  --set plugins="" \
  --set extraPlugins="rabbitmq_auth_mechanism_ssl" \
  --wait --timeout 10m \
  bitnami/rabbitmq --version 12.13.1

export RUN_RABBIT="kubectl -n rabbitns exec rabbit-chart-rabbitmq-0 -c rabbitmq -- "
export RABBIT_VHOST=nshieldvhost
${RUN_RABBIT} rabbitmqctl add_vhost ${RABBIT_VHOST}

export KS5_USER=ks5
${RUN_RABBIT} rabbitmqctl add_user $KS5_USER "ephemeralpw"
${RUN_RABBIT} rabbitmqctl set_permissions -p $RABBIT_VHOST $KS5_USER ".*" ".*" ".*"
${RUN_RABBIT} rabbitmqctl clear_password $KS5_USER

openssl genrsa -out $KS5_USER.key 4096
openssl req -new -key $KS5_USER.key -out $KS5_USER.csr \
  -subj "/CN=${KS5_USER}" \
  -addext "keyUsage=digitalSignature" \
  -addext "extendedKeyUsage=clientAuth" \
  -addext "subjectAltName=DNS:${KS5_USER}"
openssl ca -config ~/keysafe5-install/internalCA/internalCA.conf \
  -out ${KS5_USER}.crt -in ${KS5_USER}.csr -batch
rm ${KS5_USER}.csr
kubectl create secret generic ks5-messagebus-tls \
  --namespace nshieldkeysafe5 \
  --from-file=ca.crt \
  --from-file=tls.crt=ks5.crt \
  --from-file=tls.key=ks5.key

${RUN_RABBIT} rabbitmqctl delete_user guest

ipaddr=$(kubectl get svc -n rabbitns rabbit-chart-rabbitmq -o "jsonpath={.status.loadBalancer.ingress[0].ip}")
port=$(kubectl get service -n rabbitns rabbit-chart-rabbitmq  -o "jsonpath={.spec['ports'][?(@.name=='amqp-tls')].port}")
export RABBIT_URL="$ipaddr:$port/${RABBIT_VHOST}"

openssl req -new -key ~/keysafe5-install/rabbit.key \
  -out ~/keysafe5-install/rabbitmq.csr \
  -subj "/CN=rabbitmq" \
  -addext "keyUsage=digitalSignature" \
  -addext "extendedKeyUsage=serverAuth" \
  -addext "subjectAltName=DNS:rabbitmq,DNS:${DNS1},DNS:${DNS2},DNS:${DNS3},IP:${ipaddr}"
openssl ca -config ~/keysafe5-install/internalCA/internalCA.conf \
  -out rabbit2.crt \
  -in rabbitmq.csr -batch
rm rabbitmq.csr
kubectl create secret generic rabbitmq-certificates-1 \
  --namespace=rabbitns \
  --from-file=ca.crt \
  --from-file=tls.crt=rabbit2.crt \
  --from-file=tls.key=rabbit.key

helm -n rabbitns get values --all --output yaml rabbit-chart > rabbit-chart-values.yaml
helm upgrade --install rabbit-chart \
  --namespace=rabbitns \
  --values rabbit-chart-values.yaml \
  --set auth.tls.existingSecret=rabbitmq-certificates-1 \
  --wait --timeout 10m \
  bitnami/rabbitmq --version 12.13.1

kubectl create namespace mongons
kubectl create secret generic mongodb-ca-certificates \
  --namespace mongons \
  --from-file=mongodb-ca-cert=ca.crt \
  --from-file=mongodb-ca-key=internalCA/private/cakey.pem

helm install mongo-chart \
  --set image.tag=7.0.7-debian-12-r0 \
  --set architecture=replicaset \
  --set auth.enabled=true \
  --set auth.usernames={dummyuser}\
  --set auth.passwords={dummypassword} \
  --set auth.databases={authdb} \
  --set tls.enabled=true \
  --set tls.mTLS.enabled=true \
  --set tls.autoGenerated=false \
  --set tls.existingSecret=mongodb-ca-certificates \
  --namespace=mongons \
  --wait --timeout 10m  bitnami/mongodb --version 15.0.2

export MONGO1=mongo-chart-mongodb-0.mongo-chart-mongodb-headless.mongons.svc.cluster.local:27017
export MONGO2=mongo-chart-mongodb-1.mongo-chart-mongodb-headless.mongons.svc.cluster.local:27017
export MONGODB=${MONGO1},${MONGO2}

export MONGOUSER="ks5-mongo-user"
openssl genrsa -out $MONGOUSER.key 4096
openssl req -new -key $MONGOUSER.key -out $MONGOUSER.csr \
  -subj "/CN=${MONGOUSER}" \
  -addext "keyUsage=digitalSignature" \
  -addext "extendedKeyUsage=clientAuth" \
  -addext "subjectAltName=DNS:${MONGOUSER}"
openssl ca -config ~/keysafe5-install/internalCA/internalCA.conf \
  -out ${MONGOUSER}.crt -in ${MONGOUSER}.csr -batch
rm ${MONGOUSER}.csr
kubectl create secret generic ks5-mongotls \
  --namespace nshieldkeysafe5 \
  --from-file=ca.crt \
  --from-file=tls.crt=$MONGOUSER.crt \
  --from-file=tls.key=$MONGOUSER.key

export MONGODB_ROOT_PASSWORD=$(kubectl get secret --namespace mongons \
  mongo-chart-mongodb -o jsonpath="{.data.mongodb-root-password}" \
  | base64 --decode)
export MONGO_TLSUSER=$(openssl x509 -in $MONGOUSER.crt -subject -noout | cut -f2- -d= | tr -d '[:space:]')
echo $MONGO_TLSUSER

kubectl -n mongons exec \
  --stdin=true mongo-chart-mongodb-0 0 -- \
  mongosh admin --tls \
  --tlsCAFile /certs/mongodb-ca-cert \
  --tlsCertificateKeyFile /certs/mongodb.pem \
  --host 127.0.0.1 \
  --authenticationDatabase admin \
  -u root -p $MONGODB_ROOT_PASSWORD

db.createRole(
  {
    role: "hsm-mgmt-db-user",
    privileges: [
        {
          "resource": {"db": "hsm-mgmt-db", "collection": ""},
          "actions": ["createIndex", "find", "insert", "remove", "update"]
        },
      ],
    roles: []
  }
)
db.createRole(
  {
    role: "sw-mgmt-db-user",
    privileges: [
        {
          "resource": {"db": "sw-mgmt-db", "collection": ""},
          "actions": ["createIndex", "dropCollection", "find", "insert", "remove", "update"]
        },
      ],
    roles: []
  }
)
db.createRole(
  {
    role: "codesafe-mgmt-db-user",
    privileges: [
        {
          "resource": {"db": "codesafe-mgmt-db", "collection": ""},
          "actions": ["createIndex", "find", "insert", "remove", "update"]
        },
      ],
    roles: []
  }
)

use $external
x509_user = {
  user : "CN=ks5-mongo-user",
  roles : [
    {"role": "codesafe-mgmt-db-user", "db": "admin" },
    {"role": "hsm-mgmt-db-user", "db": "admin" },
    {"role": "sw-mgmt-db-user", "db": "admin" },
  ]
}
db.createUser(x509_user)

helm --namespace nshieldkeysafe5 uninstall keysafe5-istio
helm --namespace nshieldkeysafe5 uninstall keysafe5-backend
helm --namespace nshieldkeysafe5 uninstall keysafe5-ui
helm --namespace rabbitns uninstall rabbit-chart
helm --namespace mongons uninstall mongo-chart

sudo /opt/nfast/keysafe5/sbin/install -u
rm -f /opt/nfast/lib/versions/keysafe5-agent-atv.txt
rm -f /opt/nfast/sbin/keysafe5-agent
rm -f /opt/nfast/scripts/install.d/12keysafe5-agent
rm -f /opt/nfast/keysafe5/sbin/install
rm -f /opt/nfast/keysafe5/bin/ks5agenttls
rm -f /opt/nfast/keysafe5/conf/config.yaml.example

rm -rf /opt/nfast/keysafe5/conf